Zero Breach 0.1.0

Zero Breach is a local, read-only scanner that checks a computer for traces of the AdFection / Candiru campaign — where an ad-tech firm used real-time ad bidding to deliver zero-click spyware to targeted people (The Citizen Lab, 2026; Recorded Future, CTA-2025-0805).

A clean result is not a clean bill of health. Spyware of this grade is built to defeat exactly this kind of after-the-fact check, most of the traces it leaves expire within weeks, and Windows does not record DNS history unless you turn it on. If you have real reason to believe you are a target, contact the Access Now Digital Security Helpline or the Amnesty International Security Lab — not a self-service tool.

Run it

Needs Python 3.7+ (free from python.org — tick "Add python.exe to PATH"). No administrator. No third-party packages.

python -X utf8 zero-breach.py            # full scan, ~15 minutes
python -X utf8 zero-breach.py --quick    # faster, skips file fingerprinting

It only reads — it changes nothing, needs no administrator, and never touches the network (it will not even resolve an indicator). You can open it in a text editor and read every line first.

Windows gets every check. On macOS and Linux it runs the browser and file checks and reports the Windows-only checks as "not run" — never as clean.

Verify what you downloaded

Do not run a security script on trust. zero-breach.py:

SHA-256: 51cb9b38b9c136a3d57340460249d760450a62cc597cf0d77b2b507b28e2f720

Check it (Get-FileHash zero-breach.py -Algorithm SHA256 on Windows, shasum -a 256 zero-breach.py on macOS/Linux), or rebuild it yourself from source and confirm it matches — the build is deterministic:

git clone https://github.com/interplains/zero-breach && cd zero-breach
python build/build.py      # writes dist/zero-breach.py; its SHA-256 matches the above

Also in this release

DNS/ad blocklists of the campaign's domains, for a phone's or router's filter (Pi-hole, AdGuard Home, NextDNS, uBlock): adfection.hosts.txt, adfection.adblock.txt, adfection.dnsmasq.conf, adfection.domains.txt. And the indicator set as STIX and MISP feeds (adfection.stix.json, adfection.misp.json) — the STIX file works with Amnesty's Mobile Verification Toolkit for checking a phone backup.

338 indicators. Software: Apache-2.0. Indicator data: CC0 (public domain). Not affiliated with, or endorsed by, The Citizen Lab, Confiant, Recorded Future, Amnesty International or Access Now.